fix(deps): update all non-major dependencies by renovate[bot] · Pull Request #22511 · vitejs/vite

renovate · 2026-05-25T01:05:01Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@babel/core (source)	`7.29.0` → `7.29.7`
@babel/core (source)	`^7.29.0` → `^7.29.7`
@babel/parser (source)	`^7.29.3` → `^7.29.7`
@babel/plugin-transform-dynamic-import (source)	`^7.27.1` → `^7.29.7`
@babel/plugin-transform-modules-systemjs (source)	`^7.29.4` → `^7.29.7`
@babel/preset-env (source)	`^7.29.5` → `^7.29.7`
@babel/runtime (source)	`^7.29.2` → `^7.29.7`
@builder.io/qwik (source)	`^1.19.2` → `^1.20.0`
@clack/prompts (source)	`^1.4.0` → `^1.5.0`
@rollup/pluginutils (source)	`^5.3.0` → `^5.4.0`
@vitejs/devtools (source)	`^0.1.24` → `^0.3.1`
@vue/shared (source)	`^3.5.34` → `^3.5.35`
baseline-browser-mapping	`^2.10.31` → `^2.10.33`
eslint (source)	`^10.4.0` → `^10.4.1`
launch-editor-middleware	`^2.13.2` → `^2.14.0`
lint-staged	`^17.0.5` → `^17.0.7`
miniflare (source)	`^4.20260518.0` → `^4.20260526.0`
oxfmt (source)	`^0.51.0` → `^0.52.0`
pnpm (source)	`10.33.4` → `10.34.1`
sass	`^1.99.0` → `^1.100.0`
sass-embedded	`^1.99.0` → `^1.100.0`
svelte (source)	`^5.55.9` → `^5.56.0`
terser (source)	`^5.47.1` → `^5.48.0`
tinyglobby (source)	`^0.2.16` → `^0.2.17`
tsx (source)	`^4.22.3` → `^4.22.4`
typescript-eslint (source)	`^8.59.4` → `^8.60.0`
vite (source)	`^8.0.13` → `^8.0.14`
vitepress-plugin-llms	`^1.12.2` → `^1.13.1`
vue (source)	`^3.5.34` → `^3.5.35`
vue-tsc (source)	`^3.3.1` → `^3.3.3`
ws	`^8.20.1` → `^8.21.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

babel/babel (@babel/core)

`v7.29.7`

Compare Source

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

`v7.29.6`

Compare Source

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator
- #18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)
babel-core
- #18001 [7.x packport]Improve input source map handling (@JLHwung)
babel-core, babel-generator
- #17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)
Mateusz Burzyński (@Andarist)
Nicolò Ribaudo (@nicolo-ribaudo)

QwikDev/qwik (@builder.io/qwik)

`v1.20.0`

Compare Source

bombshell-dev/clack (@clack/prompts)

`v1.5.0`

Compare Source

Minor Changes

#543 83428ac Thanks @florian-lefebvre! - Adds support for Standard Schema validation

Prompts accept an optional validate() function to validate user input. While a function provides more flexibility and customization over your validation, it can be a bit verbose. To help solve this, there are libraries that provide schema-based validation to make shorthand and type-strict validation substantially easier.

Libraries following the Standard Schema specification are now natively supported. For example, using Arktype:
```
import { text } from '@&#8203;clack/prompts';
import { type } from 'arktype';

const name = await text({
	message: 'Enter your email',
+	validate: type('string.email').describe('Invalid email'),
});
```

Patch Changes

#542 adb6af9 Thanks @ghostdevv! - docs: add jsdoc for box, group, and group-multi-select
#534 3dcb31a Thanks @MattStypa! - Fixed spaces and uppercase characters in multiline prompt
#540 3170ed9 Thanks @ghostdevv! - docs: add jsdoc for autocomplete, confirm, and path prompts
Updated dependencies [83428ac, 3dcb31a]:
- @clack/core@1.4.0

rollup/plugins (@rollup/pluginutils)

`v5.4.0`

2026-05-29

Features

feat: named exports for reserved-word keys + fix duplicate default export in dataToEsm (#2002)

vitejs/devtools (@vitejs/devtools)

`v0.3.1`

Compare Source

🐞 Bug Fixes

ci: Declare unrun as devDependency where tsdown uses it - by @antfu in #368 (73e70)

View changes on GitHub

`v0.2.0`

Compare Source

🚨 Breaking Changes

Migrate logs-sdk to nostics, bump devframe to v0.3 - by @antfu in #350 (d1bc7)
Bump devframe to v0.4.1, migrate diagnostic handles to callable API - by @antfu in #358 (8b8a0)
kit: Remove deprecated APIs for v0.2.0 - by @antfu in #351 (bb65e)

🐞 Bug Fixes

core: Fix devtools asset routing under /__devtools - by @JianJroh in #353 (ee667)

🏎 Performance

rolldown: Reduce memory and rendering cost - by @webfansplz in #343 (dd413)

View changes on GitHub

vuejs/core (@vue/shared)

`v3.5.35`

Compare Source

Bug Fixes

compiler-core: avoid double processing v-for keys with v-memo (#14861) (34a0ded), closes #14859
compiler-sfc: resolve top-level exports from files registered as global types (#14805) (3d077f2), closes nuxt/nuxt#33694
runtime-core: avoid repeated hydration mismatch checks (#14857) (170fc95), closes #14855
runtime-core: skip idle persisted transition hooks in keep-alive moves (#14865) (80fc139), closes #14031
server-renderer: propagate sync errors from ssrRenderSuspense (#14804) (4760997), closes nuxt/nuxt#28162
teleport: skip child unmount when pending mount discarded (#14876) (#14877) (584beb1)

Performance Improvements

reactivity: skip type checks for cached proxies (#14860) (5734fe9)
runtime-dom: optimize array event handler dispatch (#14828) (bb18dc8)
server-renderer: avoid materializing iterables in ssrRenderList (#14821) (1b7a2cc)

web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)

`v2.10.33`

Compare Source

`v2.10.32`

Compare Source

eslint/eslint (eslint)

`v10.4.1`

Compare Source

Bug Fixes

e557467 fix: update @eslint/plugin-kit version to 0.7.2 (#20930) (Francesco Trotta)
d4ce898 fix: propagate failures from delegated commands (#20917) (Minh Vu)
f4f3507 fix: prefer-arrow-callback invalid autofix with newline after async (#20916) (kuldeep kumar)
c5bc78b fix: false positive for reference in finally block (#20655) (Tanuj Kanti)
27538c0 fix: add missing CodePath and CodePathSegment types (#20853) (Pixel998)

Documentation

61b0add docs: remove deprecated rule from related rules of max-params (#20921) (Tanuj Kanti)
305d5b9 docs: remove deprecated rules from related rules section (#20911) (Tanuj Kanti)
49b0202 docs: fix display: none of ad (#20901) (Tanuj Kanti)
9067f94 docs: switch build to Node.js 24 (#20893) (Milos Djermanovic)
c91b041 docs: Update README (GitHub Actions Bot)
e349265 docs: clarify semver strings in rule deprecation objects (#20885) (Milos Djermanovic)

Chores

b0e466b test: add data property to invalid tests cases for rules (#20924) (Tanuj Kanti)
f78838b test: add CodePath type coverage (#20904) (Pixel998)
1daa4bd chore: update eslint-plugin-eslint-comments test data to latest commit (#20922) (Francesco Trotta)
002942c ci: declare contents:read on update-readme workflow (#20919) (Arpit Jain)
64bca24 chore: update ecosystem plugins (#20912) (ESLint Bot)
6d7c832 chore: ignore fflate updates in renovate (#20908) (Pixel998)
b2c8638 ci: bump pnpm/action-setup from 6.0.7 to 6.0.8 (#20889) (dependabot[bot])
a9b8d7f chore: increase maxBuffer for ecosystem tests (#20881) (sethamus)
b702ead chore: update ecosystem update PR settings (#20884) (Pixel998)
507f60e chore: update ecosystem plugins (#20882) (ESLint Bot)
92f5c5b test: add unit test for message-count (#20878) (kuldeep kumar)
df32108 chore: add @eslint/markdown and typescript-eslint ecosystem tests (#20837) (sethamus)
327f91d chore: use includeIgnoreFile internally (#20876) (Kirk Waiblinger)
f0dc4bd chore: pin fflate@0.8.2 (#20877) (Milos Djermanovic)
0f4bd25 ci: run Discord alert for ecosystem test failures (#20873) (Copilot)

vitejs/launch-editor (launch-editor-middleware)

`v2.14.0`

Compare Source

lint-staged/lint-staged (lint-staged)

`v17.0.7`

Compare Source

Patch Changes

#1806 e692e58 - Update dependency tinyexec@^1.2.4.

`v17.0.6`

Compare Source

Patch Changes

#1803 bdf2770 - Run all tests with Deno, in addition to Node.js and Bun.
#1796 7508272 - Fix performance regression of lint-staged v17 by going back to using git add to stage task modifications. This was changed to git update-index --again in v17 for less manual work, but unfortunately the update-index command gets slower in very large Git repos.
#1797 7b2505a - This version of lint-staged uses the new staged publishing for npm packages feature. Releases are already published from GitHub Actions with trusted publishing, but now an additional approval with two-factor authentication is also required.
#1802 321b0a9 - Downgrade dependency tinyexec@1.2.2 to avoid issues in version 1.2.3.

cloudflare/workers-sdk (miniflare)

`v4.20260526.0`

Patch Changes

#14003 c1fd2fd Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260521.1 1.20260526.1
#14011 420e457 Thanks @petebacondarwin! - Warn when a remote-bindings request is blocked by Cloudflare Access

When wrangler dev is used with remote bindings and a request from the local remote-bindings proxy client to the remote workers.dev proxy server is blocked by Cloudflare Access (HTTP 403 with the Cloudflare Access block page), Wrangler now:
- Logs a single, visually striking warning per dev session explaining how to set CLOUDFLARE_ACCESS_CLIENT_ID / CLOUDFLARE_ACCESS_CLIENT_SECRET (Service Token credentials) or run cloudflared access login to authenticate.
- Replaces the original Access HTML block page with a readable plain-text body containing the same guidance, so the message also reaches the user via binding error messages (e.g. InferenceUpstreamError from env.AI.run()) and any browser response piped back via a service binding .fetch().
Previously the 403 was returned to user code with the full Access HTML, which both drowned out other logs and made it hard to tell that the failure was due to Cloudflare Access on workers.dev rather than a problem in the binding itself or the deployed proxy server. The detection runs inside the proxy client worker (which only ever talks to the remote-bindings proxy URL), so it does not trigger false positives on user-worker 403s.

`v4.20260521.0`

Compare Source

Patch Changes

#13993 0733688 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260520.1 1.20260521.1
#13999 30657e1 Thanks @edmundhung! - Fix TCP requests failing when outboundService is configured

Workers using outboundService can now open TCP connections with cloudflare:sockets. Previously, TCP requests could throw an error when a custom outbound service was configured.

`v4.20260520.0`

Compare Source

Patch Changes

#13978 fa1f61f Thanks @sassyconsultingllc! - Bump ws from 8.18.0 to 8.20.1 to address GHSA-58qx-3vcg-4xpx

GHSA-58qx-3vcg-4xpx / CVE-2026-45736 reports an uninitialized-memory disclosure in ws@<8.20.1 when a TypedArray is passed as the reason argument to WebSocket.close(). The fix shipped in ws@8.20.1 on 2026-05-12. This change bumps the workspace catalog entry so that miniflare, wrangler, and @cloudflare/vite-plugin all pick up the patched release.
#13977 2679e05 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260518.1 1.20260519.1
#13984 7e40d98 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260519.1 1.20260520.1
#13912 d803737 Thanks @petebacondarwin! - Fix /cdn-cgi/* host validation incorrectly accepting subdomains of exact configured routes

Miniflare's /cdn-cgi/* host/origin validator was treating exact configured routes the same as wildcard configured routes, so a request whose Host or Origin hostname was a subdomain of an exact route (e.g. sub.my-custom-site.com for a my-custom-site.com/* route) was incorrectly accepted. Exact configured routes and the configured upstream hostname are now required to match the request hostname exactly. Subdomain matching is only applied to wildcard routes such as *.example.com/*. Localhost hostnames continue to be allowed as before.

This affects wrangler dev and local development through @cloudflare/vite-plugin, both of which use Miniflare under the hood.
#13971 59cd880 Thanks @petebacondarwin! - Improve error diagnostics in the Browser Run binding worker

When the local Browser Run binding failed to reach an upstream — for example when Chrome failed to launch and miniflare's loopback /browser/launch endpoint returned a 500 with a stack-trace text body — the binding worker would call response.json() on the non-JSON body and throw an opaque SyntaxError: Unexpected token X, "..." is not valid JSON. The actual upstream error message (e.g. Chrome readiness probe at ... timed out after 5000ms) was discarded.

The binding worker now reads the response body as text first, surfaces the HTTP status and body content in the thrown error, and chains the original SyntaxError via cause when the body was a 2xx response that didn't parse as JSON. This makes both local-dev failures and CI test flakes self-diagnosing.
#13980 e8c2031 Thanks @petebacondarwin! - Recover from corrupted @puppeteer/browsers cache when launching a Browser Run session

When Miniflare's local Browser Run binding launches Chrome, it calls @puppeteer/browsers' install() to ensure the binary is present. If a previous install() was interrupted mid-extraction (test timeout, process kill, antivirus quarantine), the cache directory can be left partially populated — the folder exists but the executable inside it is missing. install() then throws The browser folder (...) exists but the executable (...) is missing on every subsequent call within the same process and the entire test session, breaking every later Browser Run operation until the cache is manually cleared.

launchBrowser now catches that specific error, removes the corrupted cache directory, and retries install() once. If the corruption persists after cleanup, the original error is rethrown with a clearer message.

This complements #13971, which surfaced the original error from inside the binding worker. With that diagnostic in place and this self-healing layer, the previously-intermittent "browser folder exists but executable missing" failure mode should no longer fail an entire CI run.

oxc-project/oxc (oxfmt)

`v0.52.0`

Compare Source

🚀 Features

16b8058 oxfmt: Support vite-plus/resolveConfig for vite.config.ts (#22454) (leaysgur)

pnpm/pnpm (pnpm)

`v10.34.1`: pnpm 10.34.1

Compare Source

Patch Changes

Reject pnpm-lock.yaml entries whose remote tarball resolution: block is missing the integrity field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips integrity:) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under --frozen-lockfile. pnpm now fails closed at lockfile-read time with ERR_PNPM_MISSING_TARBALL_INTEGRITY. Git-hosted tarballs (gitHosted: true or a URL on codeload.github.com / bitbucket.org / gitlab.com) and file: tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.

Platinum Sponsors

Gold Sponsors